feat(hosts): make config multi-host and add vps host
Parametrize networking, users, and containers modules under myNetworking/myUsers/myContainers so both hosts share the same logic instead of duplicating it, and split desktop/server module imports into modules/profiles/. Adds hosts/vps (not installed yet, hardware config and bootloader device are placeholders) to run Traefik, Headscale, Headplane, and Gitea via a combined Docker Compose stack. Wires up agenix for secrets and migrates miku-homelab's WireGuard private key off a plain filesystem path into an encrypted secrets/miku-homelab-wg.age. The vps side of that tunnel still needs its own key generated and encrypted after install. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
emmatherockandClaude Sonnet 5 committed
1 parent
26bfa56268
commit
42e60a3bb5
13 files changed
+695
-184
No files matched your search
+162
-76
@@ -1,81 +1,167 @@
|
||||
{ config, pkgs, ... }: {
|
||||
networking = {
|
||||
hostName = "miku-homelab";
|
||||
networkmanager.enable = true;
|
||||
firewall = {
|
||||
{ config, lib, ... }:
|
||||
|
||||
let
|
||||
cfg = config.myNetworking;
|
||||
|
||||
wireguardPeerOpts = { ... }: {
|
||||
options = {
|
||||
publicKey = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Public key of the remote WireGuard peer.";
|
||||
};
|
||||
allowedIPs = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
description = "IP ranges routed through this peer.";
|
||||
};
|
||||
endpoint = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = null;
|
||||
description = "Endpoint (host:port) of the remote peer, if it has a stable address.";
|
||||
};
|
||||
persistentKeepalive = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.int;
|
||||
default = null;
|
||||
description = "Interval in seconds for sending keepalive packets to this peer.";
|
||||
};
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
options.myNetworking = {
|
||||
hostName = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "The system hostname.";
|
||||
};
|
||||
|
||||
useNetworkManager = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = "Whether to enable NetworkManager to manage network interfaces.";
|
||||
};
|
||||
|
||||
staticIp = lib.mkOption {
|
||||
type = lib.types.nullOr (lib.types.submodule {
|
||||
options = {
|
||||
interface = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Network interface to assign the static address to.";
|
||||
};
|
||||
address = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Static IPv4 address for the interface.";
|
||||
};
|
||||
prefixLength = lib.mkOption {
|
||||
type = lib.types.int;
|
||||
description = "IPv4 prefix length for the static address.";
|
||||
};
|
||||
gateway = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Default gateway address.";
|
||||
};
|
||||
nameservers = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
default = [ "1.1.1.1" "8.8.8.8" ];
|
||||
description = "DNS nameservers to use.";
|
||||
};
|
||||
};
|
||||
});
|
||||
default = null;
|
||||
description = "Static IPv4 configuration for this host. Leave null to rely on DHCP or NetworkManager.";
|
||||
};
|
||||
|
||||
extraUdpPorts = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.port;
|
||||
default = [ ];
|
||||
description = "Additional UDP ports to open in the firewall, beyond the Tailscale port.";
|
||||
};
|
||||
|
||||
extraTcpPorts = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.port;
|
||||
default = [ ];
|
||||
description = "Additional TCP ports to open in the firewall, beyond SSH.";
|
||||
};
|
||||
|
||||
sshAllowUsers = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
default = [ ];
|
||||
description = "Usernames allowed to log in over SSH. Empty means no restriction is applied.";
|
||||
};
|
||||
|
||||
wireguard = {
|
||||
enable = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = "Whether to configure a WireGuard interface named wg-<hostName> on this host.";
|
||||
};
|
||||
ips = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
default = [ ];
|
||||
description = "IP addresses (with prefix length) assigned to the local WireGuard interface.";
|
||||
};
|
||||
privateKeyFile = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = null;
|
||||
description = "Path to the file containing this host's WireGuard private key.";
|
||||
};
|
||||
listenPort = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.port;
|
||||
default = null;
|
||||
description = "UDP port for the WireGuard interface to listen on. Leave null to auto-select, which is fine for hosts that only initiate connections outward.";
|
||||
};
|
||||
peers = lib.mkOption {
|
||||
type = lib.types.listOf (lib.types.submodule wireguardPeerOpts);
|
||||
default = [ ];
|
||||
description = "WireGuard peers this host connects to.";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
networking = lib.mkMerge [
|
||||
{
|
||||
hostName = cfg.hostName;
|
||||
networkmanager.enable = cfg.useNetworkManager;
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedUDPPorts = [ config.services.tailscale.port ] ++ cfg.extraUdpPorts;
|
||||
allowedTCPPorts = [ 22 ] ++ cfg.extraTcpPorts;
|
||||
};
|
||||
}
|
||||
(lib.mkIf (cfg.staticIp != null) {
|
||||
useDHCP = false;
|
||||
interfaces.${cfg.staticIp.interface}.ipv4.addresses = [{
|
||||
address = cfg.staticIp.address;
|
||||
prefixLength = cfg.staticIp.prefixLength;
|
||||
}];
|
||||
defaultGateway = cfg.staticIp.gateway;
|
||||
nameservers = cfg.staticIp.nameservers;
|
||||
})
|
||||
(lib.mkIf cfg.wireguard.enable {
|
||||
wireguard.interfaces."wg-${cfg.hostName}" = {
|
||||
ips = cfg.wireguard.ips;
|
||||
privateKeyFile = cfg.wireguard.privateKeyFile;
|
||||
listenPort = cfg.wireguard.listenPort;
|
||||
peers = map (peer: {
|
||||
inherit (peer) publicKey allowedIPs;
|
||||
} // lib.optionalAttrs (peer.endpoint != null) {
|
||||
inherit (peer) endpoint;
|
||||
} // lib.optionalAttrs (peer.persistentKeepalive != null) {
|
||||
inherit (peer) persistentKeepalive;
|
||||
}) cfg.wireguard.peers;
|
||||
};
|
||||
})
|
||||
];
|
||||
|
||||
services.tailscale.enable = true;
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
allowedUDPPorts = [ config.services.tailscale.port 80 443 4242 49983 24800 26900 60977];
|
||||
allowedTCPPorts = [ 22 80 443 4242 49983 24800 26900 60977];
|
||||
};
|
||||
useDHCP = false;
|
||||
interfaces.enp6s0.ipv4.addresses = [{
|
||||
address = "10.1.1.21";
|
||||
prefixLength = 24;
|
||||
}];
|
||||
defaultGateway = "10.1.1.1";
|
||||
nameservers = [ "1.1.1.1" "8.8.8.8" ];
|
||||
|
||||
wireguard.interfaces = {
|
||||
wg-miku-homelab = {
|
||||
ips = [ "10.20.0.2/24" ];
|
||||
privateKeyFile = "/etc/wireguard/miku-homelab_private.key";
|
||||
|
||||
peers = [
|
||||
{
|
||||
publicKey = "zERcSEQhan+xtmPOIjuVSkQaBynTjH96SgZZF9CZNV8=";
|
||||
allowedIPs = [ "10.20.0.1/32" ];
|
||||
endpoint = "vps.external.mikufanclub.lat:51822";
|
||||
persistentKeepalive = 25;
|
||||
}
|
||||
];
|
||||
settings = {
|
||||
PermitRootLogin = "no";
|
||||
PasswordAuthentication = false;
|
||||
} // lib.optionalAttrs (cfg.sshAllowUsers != [ ]) {
|
||||
AllowUsers = cfg.sshAllowUsers;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.tailscale.enable = true;
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PermitRootLogin = "no";
|
||||
PasswordAuthentication = false;
|
||||
AllowUsers = [ "emmatherock" ];
|
||||
};
|
||||
};
|
||||
|
||||
services.samba = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
settings = {
|
||||
global = {
|
||||
"vfs objects" = "acl_xattr";
|
||||
"map acl inherit" = "yes";
|
||||
"store dos attributes" = "yes";
|
||||
};
|
||||
mikufanclub = {
|
||||
path = "/mnt/data/mikufanclub";
|
||||
writable = "yes";
|
||||
"valid users" = "mikushare emmatherock";
|
||||
"force group" = "mikushare-group";
|
||||
"create mask" = "0660";
|
||||
"directory mask" = "0770";
|
||||
};
|
||||
data-private = {
|
||||
path = "/mnt/data";
|
||||
writable = "yes";
|
||||
"valid users" = "emmatherock";
|
||||
"browseable" = "yes";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.tailscale-udp-gro = {
|
||||
description = "Configurar UDP GRO para Tailscale";
|
||||
after = [ "network.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ExecStart = "${pkgs.ethtool}/bin/ethtool -K enp6s0 rx-udp-gro-forwarding on rx-gro-list on";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
+82
-19
@@ -1,25 +1,88 @@
|
||||
{ pkgs, ... }: {
|
||||
environment.localBinInPath = true;
|
||||
{ lib, pkgs, config, ... }:
|
||||
|
||||
users.groups.mikushare-group = {};
|
||||
|
||||
users.groups.plugdev = {};
|
||||
let
|
||||
cfg = config.myUsers;
|
||||
|
||||
users.users.emmatherock = {
|
||||
isNormalUser = true;
|
||||
description = "EmmaTheRock";
|
||||
shell = pkgs.fish;
|
||||
extraGroups = [ "plugdev" "networkmanager" "wheel" "video" "mikushare-group" "render" ];
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA8vfwM5g9RJXqHtqTgNqsYg9SxSm+UMvFqTjBoAsLJ6 emmatherock@MAIN-PC"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIpTslcK0yQ6k+h8foNl17wVRyJUfEGzq7f1h3014WNB s21 plus"
|
||||
];
|
||||
adminOpts = { ... }: {
|
||||
options = {
|
||||
description = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Human-readable description (full name) for this user.";
|
||||
};
|
||||
shell = lib.mkOption {
|
||||
type = lib.types.package;
|
||||
default = pkgs.bash;
|
||||
description = "Login shell package for this user.";
|
||||
};
|
||||
extraGroups = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
default = [ ];
|
||||
description = "Extra groups this user belongs to.";
|
||||
};
|
||||
authorizedKeys = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
default = [ ];
|
||||
description = "OpenSSH public keys authorized to log in as this user.";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
users.users.mikushare = {
|
||||
isNormalUser = true;
|
||||
description = "Acceso remoto Mikufanclub";
|
||||
group = "mikushare-group";
|
||||
createHome = false;
|
||||
serviceUserOpts = { ... }: {
|
||||
options = {
|
||||
description = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Human-readable description for this service user.";
|
||||
};
|
||||
group = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Primary group for this service user.";
|
||||
};
|
||||
createHome = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = "Whether to create a home directory for this service user.";
|
||||
};
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
options.myUsers = {
|
||||
admins = lib.mkOption {
|
||||
type = lib.types.attrsOf (lib.types.submodule adminOpts);
|
||||
default = { };
|
||||
description = "Admin users with interactive shell access.";
|
||||
};
|
||||
|
||||
serviceUsers = lib.mkOption {
|
||||
type = lib.types.attrsOf (lib.types.submodule serviceUserOpts);
|
||||
default = { };
|
||||
description = "Service users without administrative privileges, used for things like file shares.";
|
||||
};
|
||||
|
||||
extraGroups = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
default = [ ];
|
||||
description = "Extra system groups to create, beyond the ones implied by admins/serviceUsers.";
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
environment.localBinInPath = true;
|
||||
|
||||
users.groups = lib.genAttrs cfg.extraGroups (_: { });
|
||||
|
||||
users.users = lib.mapAttrs
|
||||
(_: admin: {
|
||||
isNormalUser = true;
|
||||
inherit (admin) description shell extraGroups;
|
||||
openssh.authorizedKeys.keys = admin.authorizedKeys;
|
||||
})
|
||||
cfg.admins
|
||||
// lib.mapAttrs
|
||||
(_: svc: {
|
||||
isSystemUser = true;
|
||||
inherit (svc) description group createHome;
|
||||
})
|
||||
cfg.serviceUsers;
|
||||
};
|
||||
}
|
||||
Reference in new issue
Block a user